aws / aws/aws-sdk-ruby

SSO-OIDC client example tokens trip secret scanners (Trivy jwt-token, gitleaks) — redact JWT-shaped values in the service model

Open
#3,395 1 comment 0 reactions 0 assignees View on GitHub
service-api
Dominant language
Ruby
Stars
3.7k
Forks
1.2k
Avg merge
1d 4h
Merged PRs (30d)
5

Description

### Describe the feature

The generated `Aws::SSOOIDC::Client` documentation embeds realistic-looking JWTs in its `@example` blocks for `create_token` and `create_token_with_iam`. Because these are full `eyJ…`-shaped tokens rather than obvious placeholders, secret scanners flag them as leaked credentials when they scan an application's installed gems / built container image.

Concretely, scanning an image that bundles `aws-sdk-core` (3.251.0) with Trivy's secret scanner produces a false positive on `lib/aws-sdk-ssooidc/client.rb` via the built-in `jwt-token` rule. The same false positive is reproducible with gitleaks and other regex-based scanners, and the same example values appear in `aws-sdk-js-v3` and `botocore`, so this affects downstream consumers across all AWS SDKs.

These are clearly intentional example values (account `123456789012`, `ssoins-111111111111`, the Microsoft `AbeLi@microsoft.com` sample OIDC token, etc.), so this is a documentation-quality / false-positive-noise issue, not a leaked secret.

### Affected examples

In `aws-sdk-core` 3.251.0, `lib/aws-sdk-ssooidc/client.rb` (generated from the SSO-OIDC `examples-1.json` model, API version 2019-06-10):

- `id_token` in the example responses (the `create_token_with_iam` authorization-code, JWT-bearer, and token-exchange grant examples)
- `assertion` in the JWT-bearer grant example request
- `client_secret` in the `create_token` example requests (`VERYLONGSECRETeyJ…`)

Note the inconsistency: the neighboring `access_token`, `refresh_token`, and authorization `code` examples already end in explicit `…EXAMPLEACCESSTOKEN` / `…EXAMPLEREFRESHTOKEN` / `…EXAMPLEAUTHCODE` markers, but the JWT-shaped values do not, which is exactly why scanners single them out.

### Proposed change

Redact the JWT-shaped example values in the canonical SSO-OIDC service model (`examples-1.json`) so they are unmistakably non-secret while still illustrating the field shape — for example a short, obviously-fake stub such as `eyJhbGciOiJub25lIn0.eyJzdWIiOiJFWEFNUExFIn0.EXAMPLE` or a ``-style placeholder — matching the `EXAMPLE…` convention already used for the surrounding tokens. Because the SDK clients are generated from this shared model, fixing it upstream propagates to all SDKs.

### Reproduction

```
trivy fs --scanners secret /aws-sdk-core-3.251.0
# or against an image that bundles the gem:
trivy image --scanners secret
# -> JWT (jwt-token) finding on lib/aws-sdk-ssooidc/client.rb
```

### Environment

- `aws-sdk-core` 3.251.0
- Trivy 15.0.7 (`jwt-token` secret rule); also reproducible with gitleaks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.